Legal

Data Processing Agreement

Template for clients who require one. Last updated: October 2026

This Data Processing Agreement (“DPA”) forms part of the services agreement between the client (“Controller”) and INDEXIZ (“Processor”) and applies whenever INDEXIZ processes personal data on the Controller’s behalf while delivering development, integration, hosting, support or automation services.

1. Scope and roles

The Controller determines the purposes and means of processing. INDEXIZ processes personal data only on documented instructions from the Controller, including with regard to transfers, unless required by law, in which case INDEXIZ will inform the Controller before processing where legally permitted.

2. Nature and purpose of processing

Processing is limited to what is needed to provide the agreed services, for example migrating store data, integrating systems, debugging, hosting, monitoring and support. Categories typically include customer, order, employee and supplier data; special categories are not processed unless agreed in writing.

3. Confidentiality

INDEXIZ ensures that persons authorised to process personal data are bound by confidentiality obligations and receive appropriate training.

4. Security

INDEXIZ implements appropriate technical and organisational measures, including access control on a need-to-know basis, encrypted transfer and storage where feasible, separate development and production environments, audit logging, secure credential handling and regular patching.

5. Sub-processors

INDEXIZ may use sub-processors such as cloud hosting providers, source control and CI services, and communication tools. A current list is available on request. INDEXIZ informs the Controller of intended changes, giving the Controller the opportunity to object, and imposes the same data protection obligations on each sub-processor.

6. Data subject rights

Taking into account the nature of the processing, INDEXIZ assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights.

7. Personal data breaches

INDEXIZ notifies the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, and provides the information reasonably required for the Controller’s own notifications.

8. International transfers

INDEXIZ is based in Pakistan. Where data originates from the EEA, UK or other jurisdictions with transfer restrictions, the parties rely on appropriate safeguards such as standard contractual clauses, and INDEXIZ can keep production data inside the Controller’s own cloud account on request.

9. Return and deletion

At the end of the services, INDEXIZ returns or deletes all personal data and existing copies at the Controller’s choice, unless retention is required by law, and confirms deletion in writing.

10. Audits

INDEXIZ makes available the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, with reasonable notice.

11. Term

This DPA applies for as long as INDEXIZ processes personal data on behalf of the Controller under the services agreement.

Contact

To request a signed copy of this DPA or the current sub-processor list, email info@indexiz.com.